Fix edge cases for input.size

Both setting size IDL attribute directly as well as
indirectly setting using setAttribute were not treating
values bigger than 2147483647 correctly, so fix both code
paths.

Behavior matches Firefox and Safari.

Bug: 651762

Change-Id: I6b3f2060eac9cfa6b1b8ad1898159c632257d625
Reviewed-on: https://chromium-review.googlesource.com/812010
Commit-Queue: Rob Buis <rob.buis@samsung.com>
Reviewed-by: Keishi Hattori <keishi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#525310}

third_party/WebKit/LayoutTests/external/wpt/html/dom/reflection-forms-expected.txt

 This is a testharness.js-based test.
-Found 7041 tests; 6729 PASS, 312 FAIL, 0 TIMEOUT, 0 NOTRUN.
+Found 7041 tests; 6731 PASS, 310 FAIL, 0 TIMEOUT, 0 NOTRUN.
 PASS form.title: 32 tests
 PASS form.lang: 32 tests
 PASS form.dir: 62 tests
@@ -229,9 +229,7 @@ PASS input.pattern: 32 tests
 PASS input.placeholder: 32 tests
 PASS input.readOnly: 33 tests
 PASS input.required: 33 tests
-PASS input.size: 57 tests
-NOTRUN test
-NOTRUN test
+PASS input.size: 59 tests
 PASS input.src: 38 tests
 PASS input.step: 32 tests
 PASS input.type: 256 tests

third_party/WebKit/Source/core/html/forms/HTMLInputElement.cpp

@@ -780,13 +780,13 @@ void HTMLInputElement::ParseAttribute(
   } else if (name == minlengthAttr) {
     SetNeedsValidityCheck();
   } else if (name == sizeAttr) {
-    int old_size = size_;
-    size_ = kDefaultSize;
-    int value_as_integer;
-    if (!value.IsEmpty() && ParseHTMLInteger(value, value_as_integer) &&
-        value_as_integer > 0)
-      size_ = value_as_integer;
-    if (size_ != old_size && GetLayoutObject()) {
+    unsigned size = 0;
+    if (value.IsEmpty() || !ParseHTMLNonNegativeInteger(value, size) ||
+        size == 0 || size > 0x7fffffffu)
+      size = kDefaultSize;
+    if (size_ != size) {
+      size_ = size;
+      if (GetLayoutObject())
         GetLayoutObject()
             ->SetNeedsLayoutAndPrefWidthsRecalcAndFullPaintInvalidation(
                 LayoutInvalidationReason::kAttributeChanged);
@@ -1011,7 +1011,7 @@ void HTMLInputElement::setIndeterminate(bool new_value) {
     o->InvalidateIfControlStateChanged(kCheckedControlState);
 }
 
-int HTMLInputElement::size() const {
+unsigned HTMLInputElement::size() const {
   return size_;
 }
 
@@ -1439,16 +1439,13 @@ bool HTMLInputElement::Multiple() const {
   return FastHasAttribute(multipleAttr);
 }
 
-void HTMLInputElement::setSize(unsigned size) {
-  SetUnsignedIntegralAttribute(sizeAttr, size);
-}
-
 void HTMLInputElement::setSize(unsigned size, ExceptionState& exception_state) {
   if (size == 0) {
     exception_state.ThrowDOMException(
         kIndexSizeError, "The value provided is 0, which is an invalid size.");
   } else {
-    setSize(size);
+    SetUnsignedIntegralAttribute(sizeAttr, size ? size : kDefaultSize,
+                                 kDefaultSize);
   }
 }
 

third_party/WebKit/Source/core/html/forms/HTMLInputElement.h

@@ -122,7 +122,7 @@ class CORE_EXPORT HTMLInputElement
   bool ShouldAppearChecked() const;
   bool ShouldAppearIndeterminate() const override;
 
-  int size() const;
+  unsigned size() const;
   bool SizeShouldIncludeDecoration(int& preferred_size) const;
 
   void setType(const AtomicString&);
@@ -202,7 +202,6 @@ class CORE_EXPORT HTMLInputElement
   Vector<String> AcceptFileExtensions() const;
   const AtomicString& Alt() const;
 
-  void setSize(unsigned);
   void setSize(unsigned, ExceptionState&);
 
   KURL Src() const;
@@ -408,7 +407,7 @@ class CORE_EXPORT HTMLInputElement
   AtomicString name_;
   // The value string in |value| value mode.
   String non_attribute_value_;
-  int size_;
+  unsigned size_;
   // https://html.spec.whatwg.org/multipage/forms.html#concept-input-value-dirty-flag
   unsigned has_dirty_value_ : 1;
   // https://html.spec.whatwg.org/multipage/forms.html#concept-fe-checked